OpenCTI-Platform/opencti

Features

• Threat Entity Relationship Graphs - Maps disparate threat entities through a network of edges to visualize complex attack patterns.
• Threat Intelligence Platforms - Provides a comprehensive platform for managing and analyzing cyber threat intelligence using STIX and TAXII standards.
• Threat Intelligence Platforms - Stores technical threat data using standardized schemas to organize intelligence for detailed security analysis.
• Standardized Threat Intelligence Exports - Serves standardized threat intelligence bundles to external systems via secure TAXII API endpoints.
• Graph Data Models - Employs a graph-based data model following STIX standards to represent cyber threat intelligence and relationships.
• Real-Time Data Streaming - Implements real-time data streaming for the delivery of live threat intelligence updates and entity changes.
• Cyber Threat Intelligence Maps - Converts complex security information into visual diagrams and maps to reveal threat patterns.
• Security Data Orchestrators - Automates the collection, streaming, and distribution of threat feeds across cloud infrastructure.
• Standardized Threat Intelligence Exchange - Facilitates the exchange of standardized threat intelligence bundles with external systems via secure APIs.
• Threat Relationship Visualizations - Converts complex security information into visual diagrams to reveal relationships and patterns between different threat entities.
• Distributed Document Indexing - Utilizes Elasticsearch for high-performance full-text searching and retrieval of structured intelligence data.
• Container Orchestrators - Uses container orchestrators to manage the lifecycle and resource allocation of isolated microservices.
• Container Stack Management - Manages related container services as a single logical unit to simplify resource scaling.
• Distributed Task Workers - Offloads heavy processing and feed generation to distributed task workers to maintain API responsiveness.
• Infrastructure Orchestrators - Automates the lifecycle and state management of the security platform's multi-cloud resource stacks.
• Kubernetes Deployments - Deploys and scales application components using standardized Helm charts on Kubernetes clusters.
• Real-Time Intelligence Push - Maintains persistent WebSocket connections to push real-time threat intelligence updates to clients.
• Message Brokers - Implements a Redis-based message broker for asynchronous task queuing and decoupled service communication.
• Threat Intelligence - Platform for managing cyber threat intelligence.
• Security Lab Environments - Platform for managing and sharing cyber threat intelligence.

Star history